---
title: "Restore a lost device share from the recovery kit"
method: POST
path: "/v1/keys/{key_id}/client-share/restore"
tags: ["Key Custody"]
---

# Restore a lost device share from the recovery kit

`POST /v1/keys/{key_id}/client-share/restore`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/keys/{key_id}/client-share/restore`
- Auth: HTTP bearer

For an owner who lost every passkey holding the device share. The browser
opens the kit with the recovery code locally, re-wraps share 2 under a new
passkey (master wrap), and uploads only that wrap. Needs `X-Auth-Confirm`
(a re-auth token with purpose `tss.key.restore`, or the password). Audited
`tss_key.recovered_via_code`; the owner is emailed. No waiting period: the
kit plus the code can already spend without 1Claw.

## Path parameters

- `key_id` string, uuid, required

## Headers

- `X-Auth-Confirm` string, required

## Request body

- object
  - `credential_id` string, uuid, required
  - `wrapped_share` string, required: Base64, opaque.
  - `salt` string, required: Base64 account PRF salt.
  - `group_public_key` string, required: Hex, from the kit entry.
  - `kit_proof` string, required: Base64 Schnorr proof of possession of the kit's share 3 for the key's current share generation (`@1claw/tss-wasm` `kit_share_proof`). An older generation's kit would restore a dead share, so it is refused with 400, as is a missing proof. For a `client_multisig` wallet or 2-of-3 Safe: the recovery key's hex signature over the kit digest (`multisig_kit_proof`), with the device public key as `group_public_key`.

## Response `201`

The new wrap

- ClientShareResponse
  - `id` string, uuid
  - `key_id` string, uuid
  - `key_kind` 'agent_signing_key' | 'treasury_wallet'
  - `wrap_kind` 'passkey_prf' | 'recovery_code' | 'sidecar'
  - `credential_id` string, uuid, nullable
  - `holder_id` string, uuid, nullable
  - `wrapped_share` string: Base64, exactly as stored.
  - `salt` string: Base64.
  - `wrap_version` 1 | 2
  - `generation` integer
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400`: Invalid request
- `403`: Insufficient permissions
- `404`: Resource not found

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)